CVE-2026-40199

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-40199", "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "state": "PUBLISHED", "assignerShortName": "CPANSec", "dateReserved": "2026-04-09T22:12:06.334Z", "datePublished": "2026-04-10T21:49:48.353Z", "dateUpdated": "2026-04-13T14:37:18.227Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "packageName": "Net-CIDR-Lite", "product": "Net::CIDR::Lite", "programFiles": ["Lite.pm"], "programRoutines": [{"name": "Net::CIDR::Lite::_pack_ipv6"}], "repo": "https://github.com/stigtsp/Net-CIDR-Lite", "vendor": "STIGTSP", "versions": [{"lessThan": "0.23", "status": "affected", "version": "0", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "value": "Net::CIDR::Lite versions before 0.23 for Perl mishandles IPv4 mapped IPv6 addresses, which may allow IP ACL bypass.\n\n_pack_ipv6() includes the sentinel byte from _pack_ipv4() when building the packed representation of IPv4 mapped addresses like ::ffff:192.168.1.1. This produces an 18 byte value instead of 17 bytes, misaligning the IPv4 part of the address.\n\nThe wrong length causes incorrect results in mask operations (bitwise AND truncates to the shorter operand) and in find() / bin_find() which use Perl string comparison (lt/gt). This can cause find() to incorrectly match or miss addresses.\n\nExample:\n\n my $cidr = Net::CIDR::Lite->new(\"::ffff:192.168.1.0/120\");\n $cidr->find(\"::ffff:192.168.2.0\"); # incorrectly returns true\n\nThis is triggered by valid RFC 4291 IPv4 mapped addresses (::ffff:x.x.x.x).\n\nSee also CVE-2026-40198, a related issue in the same function affecting malformed IPv6 addresses."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-130", "description": "CWE-130 Improper Handling of Length Parameter Inconsistency", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "shortName": "CPANSec", "dateUpdated": "2026-04-10T21:49:48.353Z"}, "references": [{"tags": ["patch"], "url": "https://github.com/stigtsp/Net-CIDR-Lite/commit/b7166b1fa17b3b14b4c795ace5b3fbf71a0bd04a.patch"}, {"tags": ["release-notes"], "url": "https://metacpan.org/release/STIGTSP/Net-CIDR-Lite-0.23/changes"}, {"tags": ["related"], "url": "https://www.cve.org/CVERecord?id=CVE-2026-40198"}], "solutions": [{"lang": "en", "value": "Upgrade to version 0.23 or newer, or apply the patch provided."}], "source": {"discovery": "UNKNOWN"}, "timeline": [{"lang": "en", "time": "2026-04-09T00:00:00.000Z", "value": "Vulnerability found"}, {"lang": "en", "time": "2026-04-10T00:00:00.000Z", "value": "Net-CIDR-Lite version 0.23 released"}], "title": "Net::CIDR::Lite versions before 0.23 for Perl mishandles IPv4 mapped IPv6 addresses, which may allow IP ACL bypass", "x_generator": {"engine": "cpansec-cna-tool 0.1"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-04-13T14:35:14.617789Z", "id": "CVE-2026-40199", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-13T14:37:18.227Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-40199", "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "state": "PUBLISHED", "assignerShortName": "CPANSec", "dateReserved": "2026-04-09T22:12:06.334Z", "datePublished": "2026-04-10T21:49:48.353Z", "dateUpdated": "2026-04-13T14:37:18.227Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "packageName": "Net-CIDR-Lite", "product": "Net::CIDR::Lite", "programFiles": ["Lite.pm"], "programRoutines": [{"name": "Net::CIDR::Lite::_pack_ipv6"}], "repo": "https://github.com/stigtsp/Net-CIDR-Lite", "vendor": "STIGTSP", "versions": [{"lessThan": "0.23", "status": "affected", "version": "0", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "value": "Net::CIDR::Lite versions before 0.23 for Perl mishandles IPv4 mapped IPv6 addresses, which may allow IP ACL bypass.\n\n_pack_ipv6() includes the sentinel byte from _pack_ipv4() when building the packed representation of IPv4 mapped addresses like ::ffff:192.168.1.1. This produces an 18 byte value instead of 17 bytes, misaligning the IPv4 part of the address.\n\nThe wrong length causes incorrect results in mask operations (bitwise AND truncates to the shorter operand) and in find() / bin_find() which use Perl string comparison (lt/gt). This can cause find() to incorrectly match or miss addresses.\n\nExample:\n\n my $cidr = Net::CIDR::Lite->new(\"::ffff:192.168.1.0/120\");\n $cidr->find(\"::ffff:192.168.2.0\"); # incorrectly returns true\n\nThis is triggered by valid RFC 4291 IPv4 mapped addresses (::ffff:x.x.x.x).\n\nSee also CVE-2026-40198, a related issue in the same function affecting malformed IPv6 addresses."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-130", "description": "CWE-130 Improper Handling of Length Parameter Inconsistency", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "shortName": "CPANSec", "dateUpdated": "2026-04-10T21:49:48.353Z"}, "references": [{"tags": ["patch"], "url": "https://github.com/stigtsp/Net-CIDR-Lite/commit/b7166b1fa17b3b14b4c795ace5b3fbf71a0bd04a.patch"}, {"tags": ["release-notes"], "url": "https://metacpan.org/release/STIGTSP/Net-CIDR-Lite-0.23/changes"}, {"tags": ["related"], "url": "https://www.cve.org/CVERecord?id=CVE-2026-40198"}], "solutions": [{"lang": "en", "value": "Upgrade to version 0.23 or newer, or apply the patch provided."}], "source": {"discovery": "UNKNOWN"}, "timeline": [{"lang": "en", "time": "2026-04-09T00:00:00.000Z", "value": "Vulnerability found"}, {"lang": "en", "time": "2026-04-10T00:00:00.000Z", "value": "Net-CIDR-Lite version 0.23 released"}], "title": "Net::CIDR::Lite versions before 0.23 for Perl mishandles IPv4 mapped IPv6 addresses, which may allow IP ACL bypass", "x_generator": {"engine": "cpansec-cna-tool 0.1"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-40199", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-13T14:35:14.617789Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-13T14:34:14.694Z"}}]}}

{"affected": [{"affectedData": [{"collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "packageName": "Net-CIDR-Lite", "product": "Net::CIDR::Lite", "programFiles": ["Lite.pm"], "programRoutines": [{"name": "Net::CIDR::Lite::_pack_ipv6"}], "repo": "https://github.com/stigtsp/Net-CIDR-Lite", "vendor": "STIGTSP", "versions": [{"lessThan": "0.23", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:stigtsp:net\\:\\:cidr\\:\\:lite:*:*:*:*:*:perl:*:*", "matchCriteriaId": "2B8C0BC5-5E3C-4399-9FD6-437BFF65130F", "versionEndExcluding": "0.23", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Net::CIDR::Lite versions before 0.23 for Perl mishandles IPv4 mapped IPv6 addresses, which may allow IP ACL bypass.\n\n_pack_ipv6() includes the sentinel byte from _pack_ipv4() when building the packed representation of IPv4 mapped addresses like ::ffff:192.168.1.1. This produces an 18 byte value instead of 17 bytes, misaligning the IPv4 part of the address.\n\nThe wrong length causes incorrect results in mask operations (bitwise AND truncates to the shorter operand) and in find() / bin_find() which use Perl string comparison (lt/gt). This can cause find() to incorrectly match or miss addresses.\n\nExample:\n\n my $cidr = Net::CIDR::Lite->new(\"::ffff:192.168.1.0/120\");\n $cidr->find(\"::ffff:192.168.2.0\"); # incorrectly returns true\n\nThis is triggered by valid RFC 4291 IPv4 mapped addresses (::ffff:x.x.x.x).\n\nSee also CVE-2026-40198, a related issue in the same function affecting malformed IPv6 addresses."}, {"lang": "es", "value": "Las versiones de Net::CIDR::Lite anteriores a la 0.23 para Perl manejan incorrectamente las direcciones IPv6 mapeadas a IPv4, lo que puede permitir la omisi\u00f3n de ACL de IP.\n\n_pack_ipv6() incluye el byte centinela de _pack_ipv4() al construir la representaci\u00f3n empaquetada de direcciones mapeadas a IPv4 como ::ffff:192.168.1.1. Esto produce un valor de 18 bytes en lugar de 17 bytes, desalineando la parte IPv4 de la direcci\u00f3n.\n\nLa longitud incorrecta causa resultados incorrectos en las operaciones de m\u00e1scara (AND bit a bit trunca al operando m\u00e1s corto) y en find() / bin_find() que usan la comparaci\u00f3n de cadenas de Perl (lt/gt). Esto puede hacer que find() coincida o omita direcciones incorrectamente.\n\nEjemplo:\n\n my $cidr = Net::CIDR::Lite -> new(\u201c::ffff:192.168.1.0/120\u201d);\n $cidr -> find(\u201c::ffff:192.168.2.0\u201d); # devuelve true incorrectamente\n\nEsto se activa por direcciones IPv4 mapeadas v\u00e1lidas seg\u00fan RFC 4291 (::ffff:x.x.x.x).\n\nV\u00e9ase tambi\u00e9n CVE-2026-40198, un problema relacionado en la misma funci\u00f3n que afecta a direcciones IPv6 malformadas."}], "id": "CVE-2026-40199", "lastModified": "2026-10-26T22:10:00.163", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 2.5, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-40199", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-13T14:35:14.617789Z", "version": "2.0.3"}}]}, "published": "2026-04-10T22:16:21.597", "references": [{"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "tags": ["Patch"], "url": "https://github.com/stigtsp/Net-CIDR-Lite/commit/b7166b1fa17b3b14b4c795ace5b3fbf71a0bd04a.patch"}, {"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "tags": ["Release Notes"], "url": "https://metacpan.org/release/STIGTSP/Net-CIDR-Lite-0.23/changes"}, {"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "tags": ["Third Party Advisory"], "url": "https://www.cve.org/CVERecord?id=CVE-2026-40198"}], "sourceIdentifier": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-130"}], "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,0.23)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Net::CIDR::Lite", "source": "cna", "vendor": "STIGTSP"}, "product": "net::cidr::lite", "vendor": "stigtsp"}], "analysis": {"en": {"generated_at": "2026-04-13T17:20:54.988921+00:00", "value": {"mitigation_remediation": ["Upgrade Net::CIDR::Lite to version 0.23 or later", "If upgrading is not possible, apply the patch provided in the referenced commit"], "summary": {"action": "Apply Patch", "impact": "IP ACL bypass"}, "threat_synthesis": {"affected_systems": "The flaw affects all releases of the STIGTSP Net::CIDR::Lite Perl module before version 0.23. Any system or application that imports this module to interpret IPv4-mapped IPv6 addresses or perform CIDR calculations could be impacted.", "description_and_impact": "Net::CIDR::Lite versions prior to 0.23 mishandle IPv4-mapped IPv6 addresses by appending a sentinel byte, producing an 18-byte representation instead of the expected 17 bytes. This misalignment leads to incorrect mask calculations and the find functions may return false positives or negatives when evaluating IP membership. The effect is that an application using this library for IP access control could incorrectly allow or deny traffic, effectively bypassing the ACL mechanism.", "risk_and_exploitability": "The CVSS score is 6.5, indicating moderate severity, while the EPSS score is reported as less than 1% and the vulnerability is not listed in the CISA KEV catalog. The CVE description does not mention existing exploits; the vulnerability can be exploited by supplying a crafted IPv4-mapped IPv6 address to an application that relies on Net::CIDR::Lite for ACL decisions, but availability of a public exploit is not documented."}}}}, "created": "2026-04-13T12:42:27.341765+00:00", "updated": "2026-04-14T16:36:17.346311+00:00", "vendors": ["stigtsp", "stigtsp$PRODUCT$net::cidr::lite"]}